AI Control Library / CF-05: Data Governance & Privacy
Designation: Supplemental | Control types represented: Governance and Operational
Control requirement
Handle law-enforcement requests for AI-related personal information through an authorized legal review and controlled disclosure process. Verify authority, scope and applicable restrictions, disclose only as authorized, and preserve an accountable handling record.
Why this matters
An informal request can seek more information than the organization is authorized or required to provide. AI records may also include inferred information and unrelated third-party content requiring careful scope review.
How the control types work together
Governance controls establish applicable binding external rules, laws and regulations. Operational controls translate those obligations into owned activities, review and decisions supported by relevant evidence.
When it applies
Requests involving personal information in AI inputs, outputs, logs, datasets or supplier-held records, subject to the relevant jurisdiction and circumstances.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The designated legal request authority coordinates with privacy, data custodians and security; ordinary operators do not independently decide disclosure authority.
Implementation guidance
- Route requests to the authorized function and verify requester identity, legal basis, jurisdiction and requested scope using qualified review.
- Determine preservation, disclosure, confidentiality and any notification requirements applicable to the circumstances.
- Locate responsive information through controlled access, minimize unrelated content and verify accuracy and provenance without creating unsupported new inferences.
- Authorize and securely transmit the approved disclosure, recording recipients, scope, decisions and any reviewed limitation or challenge.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Present a request scenario | It reaches authorized reviewers before information is disclosed. |
| Inspect the responsive dataset | Scope and handling follow the reviewed authority and exclude unrelated material as required. |
| Trace a disclosure | Approval, recipient verification and protected transfer are documented. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Request-handling procedure
- Verified authority and scope review
- Preservation and disclosure decisions
- Transmission and accountability records
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate uncertain authority, overbroad scope or urgent requests to the designated legal function. Preserve information only as authorized and avoid informal disclosure outside the reviewed process.
Example in practice
Hypothetical example: An investigator requests all assistant logs for a named person. Legal review establishes the applicable scope and conditions, and custodians prepare only the authorized records through a protected transfer.
Related controls
- CF05-009: AI Data Subject Rights Implementation
- CF04-011: AI Audit Log Access Control & Accountability
- CF04-016: AI Governance Evidence Management
Framework mappings
- CSA AICM (DSP-18)
- NIST AI RMF (MAP 1.1)
- ISO 42001 (Cl. 8.2)
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Data Governance & Privacy
Version 1.0